Get an anomaly by ID
GET
/anomalies/{id}
Request
Path Params
Responses
Request Request Example
Shell
JavaScript
Java
Swift
curl --location '/anomalies/'Response Response Example
{
"anomaly_kind": "string",
"dimensions": [
{
"app_access_breadth": {
"active_weeks": 0,
"baseline_mean": 0,
"baseline_stddev": 0,
"baseline_weeks": 0,
"distinct_apps": 0,
"threshold": 0,
"week_start": "2019-08-24T14:15:22.123Z"
},
"bcc_external_recipients": {
"events": [
{
"destination": "string",
"destination_domain": "string",
"event_id": "string",
"event_timestamp": "2019-08-24T14:15:22.123Z"
}
],
"external_domains": [
"string"
]
},
"dimension": "string",
"dimension_description": "string",
"dimension_label": "string",
"event_count": 0,
"event_ids": [
"string"
],
"explanation": "string",
"foreign_country": {
"countries": [
"string"
],
"logins": [
{
"assigned_country": "string",
"event_id": "string",
"event_timestamp": "2019-08-24T14:15:22.123Z",
"location": {
"city": "string",
"country": "string",
"state": "string"
}
}
]
},
"high_risk_country": {
"logins": [
{
"event_id": "string",
"event_timestamp": "2019-08-24T14:15:22.123Z",
"location": {
"city": "string",
"country": "string",
"state": "string"
},
"risk_level": "string"
}
]
},
"high_volume_external_sharing": {
"share_count": 0,
"threshold": 0
},
"impossible_travel": {
"legs": [
{
"distance_miles": 0,
"event_id": "string",
"event_timestamp": "2019-08-24T14:15:22.123Z",
"from_event_id": "string",
"from_location": {
"city": "string",
"country": "string",
"state": "string"
},
"speed_mph": 0,
"to_location": {
"city": "string",
"country": "string",
"state": "string"
}
}
]
},
"insufficient_data": true,
"mcp_tool_use_exfil_volume": {
"anomaly_score": 0,
"baseline_mean_bytes": 0,
"baseline_stddev_bytes": 0,
"bucket_date": "2019-08-24T14:15:22.123Z",
"server_history": [
{
"mcp_server": "string",
"points": [
{
"bucket_date": "2019-08-24T14:15:22.123Z",
"total_bytes": 0
}
]
}
],
"today_total_bytes": 0,
"top_contributors": [
{
"call_count": 0,
"mcp_server": "string",
"mcp_tool": "string",
"share_of_today": 0,
"total_bytes_returned": 0,
"total_bytes_sent": 0
}
],
"z_score": 0
},
"mode": "string",
"new_app_for_user": {
"events": [
{
"app_name": "string",
"app_resource_id": "string",
"event_id": "string",
"event_timestamp": "2019-08-24T14:15:22.123Z"
}
]
},
"new_country": {
"logins": [
{
"country": "string",
"country_last_recorded": "2019-08-24T14:15:22.123Z",
"event_id": "string",
"event_timestamp": "2019-08-24T14:15:22.123Z"
}
]
},
"new_destination_domain": {
"new_domains": [
"string"
]
},
"new_ip_network": {
"networks": [
{
"event_id": "string",
"first_seen": "2019-08-24T14:15:22.123Z",
"last_seen": "2019-08-24T14:15:22.123Z",
"network_range": "string"
}
]
},
"new_usb_device": {
"devices": [
{
"connection_event_id": "string",
"event_id": "string",
"first_connected": "2019-08-24T14:15:22.123Z",
"last_seen": "2019-08-24T14:15:22.123Z",
"name": "string",
"product_id": 0,
"serial_number": "string",
"vendor_id": 0
}
]
},
"non_corporate_domain": {
"domains": [
"string"
]
},
"off_hours_activity": {
"anomaly_score": 0,
"events": [
{
"event_hour_local": 0,
"event_id": "string",
"event_timestamp": "2019-08-24T14:15:22.123Z"
}
],
"timezone": "string",
"typical_hours_local": [
0
]
},
"off_role_access": {
"events": [
{
"app_categories": [
"string"
],
"app_description": "string",
"app_name": "string",
"event_id": "string",
"event_timestamp": "2019-08-24T14:15:22.123Z"
}
],
"reason": "string",
"user_department": "string",
"user_job_category": "string",
"user_job_title": "string"
},
"proxy_login": {
"has_unapproved_vpn": true,
"operators": [
{
"asn_name": "string",
"event_id": "string",
"is_allowed": true,
"kind": "string",
"name": "string",
"suspicion_score": 0,
"usage_type": "string"
}
]
},
"recipient_unique_to_user": {
"emails": [
"string"
]
},
"volume_threshold": {
"bucket_date": "2019-08-24T14:15:22.123Z",
"bucket_size": "string",
"count": 0,
"count_limit": 0,
"folders_only": true,
"series": "string",
"size": 0,
"size_limit": 0
},
"volumetric": {
"active_buckets": 0,
"actual_value": 0,
"baseline_value": 0,
"baseline_withheld": true,
"bucket_size": "string",
"comparison_group": "string",
"group_scores": [
{
"baseline_value": 0,
"baseline_withheld": true,
"comparison_group": "string",
"group_size": 0,
"z_score": 0
}
],
"group_size": 0,
"lookback_buckets": 0,
"low_confidence": true,
"observation_count": 0,
"ratio_to_baseline": 0,
"size_metric": true,
"z_score": 0
}
}
],
"employee_email": "string",
"employee_name": "string",
"happened": "2019-08-24T14:15:22.123Z",
"id": "string"
}Modified at 2026-10-20 18:32:30